Obama puts FBI in charge of responding to cyberattacks following DNC hack

The White House has put the FBI in charge of responding to any cyberattack against the government, major US organisations or companies, under a new directive approved by President Barack Obama.

"As with terrorism, because it's not always clear who is the actor, the FBI will take the lead," said White House counter-terrorism adviser Lisa Monaco at a cyber conference, the Wall Street Journal reports. "This directive establishes a clear framework to coordinate the government's response to such incidents."

Numbered PPD-41, the directive gives companies and the public an idea of which agencies will respond to specific types of cyberattacks such as a banking security breach or an assault targeting a power grid to take it offline.

"It spells out which federal agencies are responsible," Monaco said. "And it will help answer a question heard too often from corporations and citizens alike — 'In the wake of an attack, who do I call for help?'"

While the FBI will take the lead in investigating national security and criminal breaches, the Department of Homeland Security will assist companies that have been hacked and help them reduce the impact and reach of the attack. The Cyber Intelligence Integration Centre will be tasked with gathering information about a cyber-incident to help identify who initiated the assault.

The directive also features a five-level grading system for cyberattacks, ranging from level zero to level 5. According to a source "familiar with the policy discussions", no known incident has reached Level 5 yet, Reuters reports.

According to the directive, a "significant cyber incident" is defined as one that is "likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people".

However, some current US national security officials, who spoke to Reuters anonymously, have expressed their concerns about the order saying it does not specify how the US should tackle attacks that target infrastructure systems and networks, but do not kill anyone. They added that it does not specify the point at which an attack would warrant a military response.

"Is it worse than what a bomb could do, and if we decide it is, what's the appropriate response?" asked one of the officials.

Reportedly being developed for months, the announcement of the directive comes as the FBI launches an investigation into the alleged Russian hack of the Democratic National Committee. Cyberattacks from both foreign nations and malicious actors targeting the government, private companies and individuals have also been on the rise in recent years as well with attacks becoming increasingly bolder, more sophisticated and costly.

"We are in the midst of a revolution of the cyber threat — one that is growing more persistent, more diverse, more frequent and more dangerous every day," Monaco said.